KV plugin filter not working

This is my config filter
grok {
match => { "message" => "<%{INT:number}>%{SYSLOGTIMESTAMP:timestamp}%{SPACE}%{NOTSPACE:app}%{SPACE}%{NOTSPACE:logsource}[%{WORD:status}]%{SPACE}%{INT:eventid}%{SPACE}%{GREEDYDATA:mess}.%{SPACE}%{GREEDYDATA:service}:%{SPACE}%{GREEDYDATA:wininfo}"}
kv {
source => "wininfo"
value_split => ":"
field_split => "\x7f+"}

Character "\x7f" is DEL character, it seperates the pairs. But kv not working at all. Thanks for any helps

field_split takes only a single character. You need to use field_split_pattern which takes a regex.

I am using logstash 6.1.0, and this is my ERROR when use split pattern
[ERROR][logstash.filters.kv ] Unknown setting 'field_split_pattern' for kv
I checked the document about KV filter, I don't understand why it is false.

You can update the plugin by running logstash-plugins update logstash-filter-kv or just update all plugins with logstash-plugins update

1 Like

Okay thanks. I solved it

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.